Android.Xiny.591

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.672.origin
Android.Mixi.16.origin
Android.Mixi.32.origin
Android.Xiny.164.origin
Android.Xiny.202.origin
Android.Xiny.73.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) rt.hm####.com:80
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) 45.33.1####.188:80
TCP(HTTP/1.1) of.okyes####.com:80
TCP(HTTP/1.1) cel####.com:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) d.hiph####.b####.com:80
TCP(HTTP/1.1) ba####.thereal####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.snapbac####.com:80
TCP(HTTP/1.1) us-scp####.ali####.com:80
TCP(HTTP/1.1) gpup####.min####.com:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) besta####.com:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) c####.whatthe####.com:80
TCP(HTTP/1.1) www.okyes####.com:8080
TCP(HTTP/1.1) offer####.online:80
TCP(HTTP/1.1) secur####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) olympic####.com:80
TCP(HTTP/1.1) offence####.accountant:80
TCP(HTTP/1.1) kingktr####.com:80
TCP(HTTP/1.1) www.koapk####.com:8081
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) pm.zhuo####.com:80
TCP(HTTP/1.1) hy####.com:80
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) c####.com:80
TCP(HTTP/1.1) cld-se####.com:80
TCP(TLS/1.0) m.ali####.com:443
TCP(TLS/1.0) questio####.com:443
TCP(TLS/1.0) h####.b####.com:443
TCP(TLS/1.0) wild####.al####.com.####.net:443
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.net:5224

DNS requests:

as####.al####.com
ba####.thereal####.com
besta####.com
c####.ali####.com
c####.com
c####.g####.ig####.com
c####.whatthe####.com
c-h####.g####.com
cel####.com
cld-se####.com
cldl####.com
d####.zhuo####.com
d.hiph####.b####.com
down####.zhuo####.com
gp.lik####.com
gp.miaoxi####.com
gpup####.min####.com
h####.b####.com
hy####.com
kingktr####.com
m.ali####.com
of.okyes####.com
offence####.accountant
offer####.online
offerse####.go2c####.org
olympic####.com
pm.zhuo####.com
questio####.com
rt.hm####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
secur####.com
sh.penc####.com
t####.snapbac####.com
u.al####.com
www.koapk####.com
www.okyes####.com

HTTP GET requests:

ba####.thereal####.com/redirect?target=####&ts=####&hash=####&rm=####
besta####.com/?r=####&zoneid=####&pbk3=####&empty=####&var=####&uuid=###...
besta####.com/afu.php?zoneid=####&var=####
c####.com/?a=####&c=####&s1=####&s2=####
c####.whatthe####.com/?utm_medium=####&utm_campaign=####
c####.whatthe####.com/?utm_term=####&clickverify=####&utm_content=####
c####.whatthe####.com/proc.php?7544f9c####
cel####.com/page?cam=####&country=####&pub=####&clickid=####&subid=####
cld-se####.com/?a=####&c=####&s1=####&s2=####
cld-se####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
d.hiph####.b####.com/wisegame/pic/item/c3ec08fa513d269742c590f15dfbb2fb4...
gp.miaoxi####.com/cr/sv/getGoFile?name=####
gp.miaoxi####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=...
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.min####.com/apk/des_libneo321.zip
hy####.com/28c88/4acA/76MQ/t-9Gs6VqRfgVCfcgxeCEkAI6SfAXQk8arOD0goKhos-Ud...
kingktr####.com/aff_c/?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=#...
kingktr####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&aff_sub2=##...
of.okyes####.com/redirect?uid=####&sourceid=####&clickid=####
offence####.accountant/10.jpg
offence####.accountant/11.jpg
offence####.accountant/7.jpg
offence####.accountant/8.jpg
offence####.accountant/9.jpg
offence####.accountant/?brand=####&model=####&browser=####&td=####&voluu...
offence####.accountant/flag.png
offence####.accountant/index.html
offence####.accountant/ip7.png
offence####.accountant/iphone6.jpg
offence####.accountant/iphone7.jpg
offence####.accountant/item1.png
offence####.accountant/item2.png
offence####.accountant/item3.png
offence####.accountant/like.png
offence####.accountant/search.png
offence####.accountant/tick.png
offer####.online/r/9772c794-ff2e-11e7-8db1-1144f3b123c1/0/
offer####.online/r/9772c794-ff2e-11e7-8db1-1144f3b123c1/1/
olympic####.com/?a=####&c=####&s1=####&s2=####
pm.zhuo####.com/Api/getPlayBanner?titleId=####&packId=####&language=####
pm.zhuo####.com/Api/getStartFigure?packId=####
pm.zhuo####.com/Api/playGift?titleId=####&packId=####
pm.zhuo####.com/upload//a.hiphotos.bdimg.com/wisegame/wh=72,72/sign=ada4...
pm.zhuo####.com/upload//b.hiphotos.bdimg.com/wisegame/pic/item/f35298227...
pm.zhuo####.com/upload//c.hiphotos.bdimg.com/wisegame/pic/item/447f9e2f0...
pm.zhuo####.com/upload//c.hiphotos.bdimg.com/wisegame/pic/item/d1fb43166...
pm.zhuo####.com/upload//d.hiphotos.bdimg.com/wisegame/pic/item/c3ec08fa5...
pm.zhuo####.com/upload//download.zhuoyian.com/upload/37D1AA67AC157B624B3...
pm.zhuo####.com/upload//download.zhuoyian.com/upload/ED90BF1AAC157B6369E...
pm.zhuo####.com/upload//e.hiphotos.bdimg.com/wisegame/pic/item/4ddda3cc7...
pm.zhuo####.com/upload//g.hiphotos.bdimg.com/wisegame/pic/item/0863f6246...
pm.zhuo####.com/upload//g.hiphotos.bdimg.com/wisegame/pic/item/459759ee3...
pm.zhuo####.com/upload//g.hiphotos.bdimg.com/wisegame/pic/item/d01c8701a...
pm.zhuo####.com/upload//h.hiphotos.bdimg.com/wisegame/pic/item/e401a18b8...
pm.zhuo####.com/upload/37D1AA67AC157B624B3C07D5765AC15A.png
pm.zhuo####.com/upload/37D1AA68AC157B6203446B831FA23CB4.jpg
pm.zhuo####.com/upload/37D1AA69AC157B620B1B5B5228DDCB64.jpg
pm.zhuo####.com/upload/37D1AA69AC157B622032F74BD13B5308.jpg
pm.zhuo####.com/upload/37D1AA69AC157B624FBDFE462F9304B2.jpg
pm.zhuo####.com/upload/37D1AA69AC157B626F8588466D258BC5.jpg
pm.zhuo####.com/upload/B39A6CEFFFFFFFE26FFFB3834FE51B50.jpg
rt.hm####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
rt.hm####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
rt.hm####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
rt.hm####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
rt.hm####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
rt.hm####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
rt.hm####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
rt.hm####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze
rt.hm####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze
secur####.com/?a=####&c=####&s1=####&s2=####&ckmguid=####
t####.snapbac####.com/c3759a1a-a2e4-494c-8aeb-dcf9897ad791?pubid=####&ki...
t####.snapbac####.com/click
ti####.c####.l####.####.com/config/hz-hzv3.conf
us-scp####.ali####.com/rd/kdopppr6?pid=####&tp1=####&cv=####&cn=####

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
gp.miaoxi####.com/cr/sv/getEPList
pm.zhuo####.com/Api/AddActivate
pm.zhuo####.com/Api/GetNewVersion
pm.zhuo####.com/Api/UnifiedAccess
pm.zhuo####.com/Api/package
pm.zhuo####.com/Api/playDetail
sdk.o####.p####.####.com/api.php?format=####&t=####
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8080/sdk/cb.action
www.okyes####.com:8080/sdk/td.action
www.okyes####.com:8081/sdk/nsd.action?b=####
www.okyes####.com:8081/sdk/nsd.action?b=####&ci=####&ct=####&re=####&sd=...

Modified file system:

Creates the following files:

/data/.xbin/api
/data/.xbin/bkoatdump_pooj_radish
/data/.xbin/cid
/data/.xbin/disp
/data/.xbin/mid
/data/.xbin/release
/data/.xbin/uid
/data/local/####/api
/data/local/####/cid
/data/local/####/disp
/data/local/####/mid
/data/local/####/release
/data/local/####/uid
/system/bin/####/api
/system/bin/####/bkload_jpoo_hd
/system/bin/####/cid
/system/bin/####/disp
/system/bin/####/mid
/system/bin/####/release
/system/bin/####/uid
/system/bin/.install-recovery.luno.sh
/system/bin/debuggerd
/system/bin/debuggerd_hulu
/system/bin/debuggerd_server
/system/bin/install-recovery.sh
/system/bin/kcol_ysy
/system/bin/oatdump_pooj_radish
/system/etc/install-cm-recovery.sh
/system/etc/install-recovery-2.sh
/system/etc/install-recovery.sh
/system/etc/install_recovery.sh
/system/xbin/.kugua
/system/xbin/load_jpoo_hd
/system/xbin/supolicy
<Package Folder>/app_DEX_OPT/01935751.dex
<Package Folder>/app_DEX_OPT/12594816.dex
<Package Folder>/app_DEX_OPT/20276967.dex
<Package Folder>/app_DEX_OPT/50796664.dex
<Package Folder>/app_DEX_OPT/51309453.dex
<Package Folder>/app_DEX_OPT/55969261.dex
<Package Folder>/app_DEX_OPT/99856375.dex
<Package Folder>/app_mdex/abc.zip
<Package Folder>/app_mdex/classes.dex
<Package Folder>/com.init.env/####/AD_ID_SPINFO.xml
<Package Folder>/com.init.env/####/data_0
<Package Folder>/com.init.env/####/data_1
<Package Folder>/com.init.env/####/data_2
<Package Folder>/com.init.env/####/data_3
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1510835202663.zip
<Package Folder>/com.init.env/####/f_000001
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/index
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/load_jpoo_hd
<Package Folder>/com.init.env/####/oatdump_pooj_radish
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1510835202772.zip
<Package Folder>/com.init.env/####/webview.db-journal
<Package Folder>/com.init.env/####/webviewCookiesChromium.db-journal
<Package Folder>/databases/DownloandFile_db-journal
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushg.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/01935751.apk
<Package Folder>/files/####/0667A95D81182CEE4980194E6B3448B9
<Package Folder>/files/####/12594816.apk
<Package Folder>/files/####/20276967.apk
<Package Folder>/files/####/50796664.apk
<Package Folder>/files/####/51309453.apk
<Package Folder>/files/####/55969261.apk
<Package Folder>/files/####/58D6D09AADCD5690D884B42DA1E1526D
<Package Folder>/files/####/5A2DEEC9B12BF55348CA0900586E918E
<Package Folder>/files/####/5youxizhongxing1102<System Property>46
<Package Folder>/files/####/7F289ED17D94AAB0C0E627FF76A010F4
<Package Folder>/files/####/86FC38B4D08448D47AC9D835E2341921
<Package Folder>/files/####/9072F548E35AF3DBF3517DBC1A1C3108
<Package Folder>/files/####/99856375.apk
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/BE1B9C52F237FEC2A7B2DFB66AAF1E74
<Package Folder>/files/####/D7CB250A86A38C079925FCE27FFB9422
<Package Folder>/files/####/DB7EB1CE34E4E63060FEF71B573D9BBA
<Package Folder>/files/####/dk356.data
<Package Folder>/files/####/dk846.data
<Package Folder>/files/####/dk914.data
<Package Folder>/files/####/dk946.data
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/ja201801152050.data
<Package Folder>/files/####/ntmp20792134
<Package Folder>/files/####/rs23.data
<Package Folder>/files/####/test
<Package Folder>/files/####/ym43.data
<Package Folder>/files/1510835201169_libneo32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708041650.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/__local_ap_info_cache.json
<Package Folder>/files/__local_last_session.json
<Package Folder>/files/__local_stat_cache.json
<Package Folder>/files/__send_data_1510835199761
<Package Folder>/files/__send_data_1510835244048
<Package Folder>/files/c201708041650.apk
<Package Folder>/files/gdaemon_20161017
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libcuid.so
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
<Package Folder>/p.dk356/####/forever.sh
<Package Folder>/p.dk356/####/krcfg.txt
<Package Folder>/p.dk356/####/krmain
<Package Folder>/p.dk356/####/krmain1510835253665.zip
<Package Folder>/p.dk356/####/krsdk.cert
<Package Folder>/p.dk846/####/forever.sh
<Package Folder>/p.dk846/####/krcfg.txt
<Package Folder>/p.dk846/####/krmain
<Package Folder>/p.dk846/####/krmain1510835242780.zip
<Package Folder>/p.dk846/####/krsdk.cert
<Package Folder>/p.dk914/####/forever.sh
<Package Folder>/p.dk914/####/krcfg.txt
<Package Folder>/p.dk914/####/krsdk.cert
<Package Folder>/p.dk946/####/forever.sh
<Package Folder>/p.dk946/####/krcfg.txt
<Package Folder>/p.dk946/####/krmain
<Package Folder>/p.dk946/####/krmain1510835203534.zip
<Package Folder>/p.dk946/####/krsdk.cert
<Package Folder>/p.rl23/####/cnVuc2hlbGwy
<Package Folder>/p.rl23/####/cnVuc2hlbGwy1510835262615.zip
<Package Folder>/p.rl23/####/forever.sh
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51510835237277.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
<Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/baseactivity_share_name.xml
<Package Folder>/shared_prefs/basefragment_share_name.xml
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/gx_sp.xml
<SD-Card>/APPMarket/####/125183428.jpg.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/715119f29f736652abd3f673bc8acf54.0
<SD-Card>/Android/####/journal.tmp
<SD-Card>/HorseBrowser/####/c3ec08fa513d269742c590f15dfbb2fb4316d80c.jpg
<SD-Card>/backups/####/.confd
<SD-Card>/backups/####/.confd-journal
<SD-Card>/backups/####/.cuid
<SD-Card>/backups/####/.cuid2
<SD-Card>/backups/####/.timestamp
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db
<SD-Card>/test1510835201377

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
/system/bin/sh <Package Folder>/p.dk946/files/forever.sh
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 26006 300 0
<Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
c201708041650.apk -p <Package> -c <Package>:baidu
chmod 0755 <Package Folder>/com.init.env
chmod 0771 <Package Folder>/.syslib-
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dk356/files/forever.sh
chmod 0777 <Package Folder>/p.dk356/files/krmain
chmod 0777 <Package Folder>/p.dk846/files/forever.sh
chmod 0777 <Package Folder>/p.dk846/files/krmain
chmod 0777 <Package Folder>/p.dk914/files/forever.sh
chmod 0777 <Package Folder>/p.dk946/files/forever.sh
chmod 0777 <Package Folder>/p.dk946/files/krmain
chmod 0777 <Package Folder>/p.dk946/files/krsdk.cert
chmod 0777 <Package Folder>/p.rl23/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.rl23/files/forever.sh
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 6777 <Package Folder>/files/c201708041650.apk
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 770 <Package Folder>/files/.play/test
chmod 777 <Package Folder>/p.dk356/files/krcfg.txt
chmod 777 <Package Folder>/p.dk846/files/krcfg.txt
chmod 777 <Package Folder>/p.dk914/files/krcfg.txt
chmod 777 <Package Folder>/p.dk946/files/krcfg.txt
getenforce
load_jpoo_hd
load_jpoo_hd -c id
logcat -d -v time
ls -l /system/bin/su
ps
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s > /dev/null 2>&1
sh /system/bin/load_jpoo_hd
sh /system/bin/load_jpoo_hd -c id
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 9d051a7f5ce243ccaa3a5a10e8d24c4e
sh <Package Folder>/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 9d051a7f5ce243ccaa3a5a10e8d24c4e <Package Folder>/.syslib-
su
su -c id

Loads the following dynamic libraries:

1510835201169_libneo32
com_zhuoyian_youxizhongxing110
getuiext2
libjni-comymrefpackagesjrrbaidu

Uses elevated priveleges.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней